From: Jonathan Bittner <jbittner.br.bugs@gmail.com>
To: buildroot@buildroot.org
Subject: Re: [Buildroot] Troubles with SELinux
Date: Fri, 17 Mar 2023 11:20:02 -0400 [thread overview]
Message-ID: <CANgJbdXqFfHtd=fnutfAkJXnRzhZH=SuLeme8P4gOxVnvTrCuA@mail.gmail.com> (raw)
In-Reply-To: <CANgJbdVKFO_HvXOvrMcJW_bb=QXnpB6T7M9T+r1ypR7icwfPWA@mail.gmail.com>
[-- Attachment #1.1: Type: text/plain, Size: 1306 bytes --]
On Thu, Mar 16, 2023 at 12:33 PM Jonathan Bittner <
jbittner.br.bugs@gmail.com> wrote:
> I'm developing an embedded config on an Intel Atom board. It is a
> government app and will go through vetting. Likely it will be compared to
> the RedHat and Ubuntu Security Technical Implementation Guides (STIGs) as
> there no specific embedded Linux STIGs.
>
I hate replying to my own posts but I learned two additional things during
my experimentation yesterday:
1.) an early forced relabel (S000relabel service) on a fresh filesystem
helps fix some issues
2.) Switching to SystemV init allowed more useful troubleshooting in
permissive mode: auditd could run early, reported exceptions were logged,
and authorizations could be added. I think BusyBox init somehow just turns
SElinux off (no reporting) in permissive mode.
3.) My issues with ssh login is apparently the /etc/pam.d/sshd that ships
with the system contains no reference to any of the SELinux modules in the
auth stack which means the contexts are not set during the login. I
haven't quite fixed this yet. Most of the sample configs I've found online
were distribution-specific and had external references (includes) to files
shipped by that distro, often incorporating distro-specific modules not
shipped with Buildroot
[-- Attachment #1.2: Type: text/html, Size: 1661 bytes --]
[-- Attachment #2: Type: text/plain, Size: 150 bytes --]
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2023-03-17 15:20 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-16 16:33 [Buildroot] Troubles with SELinux Jonathan Bittner
2023-03-17 15:20 ` Jonathan Bittner [this message]
2023-03-18 21:43 ` Jonathan Bittner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CANgJbdXqFfHtd=fnutfAkJXnRzhZH=SuLeme8P4gOxVnvTrCuA@mail.gmail.com' \
--to=jbittner.br.bugs@gmail.com \
--cc=buildroot@buildroot.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).